Ensure artifacts contain information about their origin

보통레벨 1수동 검토github

설명

When delivering artifacts, ensure they have information about their origin. This may be done by providing a Software Bill of Manufacture (SBOM) or some metadata files. Information about artifact origin can be used for verification purposes. Having this kind of information allows the user to decide if the organization supplying the artifact is trusted. Reported as a manual review item: no reliable read-only gh api check exists for this control.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

For each artifact, ensure it has information about its origin. Expected state: For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.

조치 방법

조치 방식: 가이드 또는 인프라 패치

For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.

속성

운영 체제: 모두
태그: githubartifacts
참고 자료: CIS GitHub Benchmark v1.2.0 - 4.4.1 Ensure artifacts contain information about their origin